CVE-2024-36536: Incorrect Authorization

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27056 · Fabedge · Fabedge

Name of the Vulnerable Software and Affected Versions: fabedge version 0.8.1 Description: The issue concerns insecure permissions in fabedge, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For fabedge version 0.8.1,...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36536

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36538

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36535

Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

Contour 安全漏洞

Contour is a Project Contour open source Kubernetes entry controller using the Envoy proxy. A security vulnerability exists in Contour 1.28.3 and earlier versions, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and elevate...

CVE-2024-36532

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36532

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36532

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

Kruise Security Vulnerabilities

Kruise is an application from the Cloud Native Computing Foundation CNCF. A security vulnerability exists in kruise version v1.6.2. An attacker exploited the vulnerability to access sensitive data and elevate privileges by obtaining a token for a service account...

PT-2024-27052 · Kruise · Kruise

Name of the Vulnerable Software and Affected Versions: kruise version 1.6.2 Description: The issue is related to insecure permissions, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For kruise version 1.6.2, update th...

CVE-2024-36532

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

Azure File CSI Driver 安全漏洞

The Azure File CSI Driver is a driver organized by the Kubernetes SIG. A security vulnerability exists in the Azure File CSI Driver that stems from the fact that a participant with access to the driver's logs can observe the service account token...

PT-2024-37897 · Ansible · Ansible Automation Controller

Name of the Vulnerable Software and Affected Versions: Ansible Automation Controller affected versions not specified Description: An improper authorization flaw exists in the Ansible Automation Controller, allowing an attacker using the k8S API server to send an HTTP request with a service accoun...

PT-2022-4760 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.5.16 SUSE Rancher versions prior to 2.6.7 Description: The issue is related to the cleartext storage of sensitive information in SUSE Rancher, allowing authenticated users to retrieve plaintext versions of...

Cross-Site Request Forgery in Jenkins Alauda Kubernetes Suport Plugin

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials...

GHSA-7H24-4X4C-69MF Improper Authorization in Jenkins Alauda Kubernetes Suport Plugin

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or...